shibd crashing, last seen extracting issuer

[Tom Mitchell]

Hi,

I’m using Shibboleth service provider 2.4.3 on Ubuntu Linux. It’s been rock solid until yesterday when we experienced a crash. A little digging in the logs led us to a specific IdP that correlates to the crashes. We coordinated a test and I turned on debugging.

Here are the last few messages, all involving that IdP. at 10:10:35 they were redirected from our SP to their IdP. At 10:11:43 authentication was complete and their IdP was sending a Response message. Moments later the shibd process was gone.

2014-02-19 10:10:35 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [3]: message encoded, sending redirect to client
2014-02-19 10:11:43 DEBUG Shibboleth.Listener [4]: dispatching message (default/SAML2/POST)
2014-02-19 10:11:43 DEBUG OpenSAML.MessageDecoder.SAML2POST [4]: validating input
2014-02-19 10:11:43 DEBUG OpenSAML.MessageDecoder.SAML2POST [4]: decoded SAML message:
<XML elided — see below>
2014-02-19 10:11:43 DEBUG OpenSAML.MessageDecoder.SAML2 [4]: extracting issuer from SAML 2.0 protocol message
[end of messages, shibd process is gone]


Here is the captured Response message is below. The only thing I’ve noticed on visual inspection is that the Issuer does not match their entityID. But that doesn’t feel like something that would cause a crash. They are updating so that the Issuer and entityID match. I’m curious if someone else sees something here that I’m missing. My searches in the mailing list and via google mostly show crashes that got a bit further in the logs than we’re getting.

Thanks,
Tom


Response message with CipherValues removed for brevity:

<?xml version="1.0"?>
<samlp:Response
    xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
    ID="_7d5c3902-d847-477d-822a-d24cb6297024"
    Version="2.0"
    IssueInstant="2014-02-19T15:09:39.823Z"
    Destination="https://portal.geni.net/Shibboleth.sso/SAML2/POST"
    Consent="urn:oasis:names:tc:SAML:2.0:consent:unspecified"
    InResponseTo="_734ec69e771ef4d895e0494defc4207c">
<Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion">http://ADFS.Morgan.edu/adfs/services/trust</Issuer>
<samlp:Status>
    <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
</samlp:Status>
<EncryptedAssertion xmlns="urn:oasis:names:tc:SAML:2.0:assertion">
    <xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" Type="http://www.w3.org/2001/04/xmlenc#Element">
    <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc"/>
    <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
    <e:EncryptedKey xmlns:e="http://www.w3.org/2001/04/xmlenc#">
    <e:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p">
    <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
</e:EncryptionMethod>
<KeyInfo>
    <ds:X509Data xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
    <ds:X509IssuerSerial>
        <ds:X509IssuerName>CN=panther.gpolab.bbn.com</ds:X509IssuerName>
        <ds:X509SerialNumber>14953254068193760312</ds:X509SerialNumber>
    </ds:X509IssuerSerial>
</ds:X509Data>
</KeyInfo>
<e:CipherData>
    <e:CipherValue></e:CipherValue>
</e:CipherData>
</e:EncryptedKey>
</KeyInfo>
<xenc:CipherData>
    <xenc:CipherValue></xenc:CipherValue>
</xenc:CipherData>
</xenc:EncryptedData>
</EncryptedAssertion>
</samlp:Response>